[libvirt] [PATCH] qemu: Fix crash in qemucapsprobe

[John Ferlan]

On 09/27/2016 07:47 AM, Jiri Denemark wrote:
> The qemucapsprobe helper calls virQEMUCapsInitHostCPUModel with
> caps == NULL, causing the following crash:
> 
>     Program received signal SIGSEGV, Segmentation fault.
>     #0  0x00007ffff788775f in virQEMUCapsInitHostCPUModel
>         (qemuCaps=qemuCaps at entry=0x649680, host=host at entry=0x10) at
>         src/qemu/qemu_capabilities.c:2969
>     #1  0x00007ffff7889dbf in virQEMUCapsNewForBinaryInternal
>         (caps=caps at entry=0x0, binary=<optimized out>,
>         libDir=libDir at entry=0x4033f6 "/tmp", cacheDir=cacheDir at entry=0x0,
>         runUid=runUid at entry=4294967295, runGid=runGid at entry=4294967295,
>         qmpOnly=true) at src/qemu/qemu_capabilities.c:4039
>     #2  0x0000000000401702 in main (argc=2, argv=0x7fffffffd968) at
>         tests/qemucapsprobe.c:73
> 
> Signed-off-by: Jiri Denemark <jdenemar at redhat.com>
> ---
>  src/qemu/qemu_capabilities.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 

Earlier in this function there's:

    if (!cacheDir)
        rv = 0;
    else if ((rv = virQEMUCapsInitCached(caps, qemuCaps, cacheDir)) < 0)
        goto error;


virQEMUCapsInitCached will call virQEMUCapsLoadCache which will call
virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host); as well.

So wouldn't it better to have virQEMUCapsInitHostCPUModel take "caps" as
the parameter and then return "silently" if !caps->host ?

John

> diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
> index 4d859c4..73a7fd4 100644
> --- a/src/qemu/qemu_capabilities.c
> +++ b/src/qemu/qemu_capabilities.c
> @@ -4036,7 +4036,8 @@ virQEMUCapsNewForBinaryInternal(virCapsPtr caps,
>              virQEMUCapsRememberCached(qemuCaps, cacheDir) < 0)
>              goto error;
>  
> -        virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host);
> +        if (caps)
> +            virQEMUCapsInitHostCPUModel(qemuCaps, &caps->host);
>      }
>  
>   cleanup:
>